# Forge visibility policy (ORGREF-WP-0002-T01)

Status: **partly decided** (founder, 2026-10-08). Points 1 and 2 are decided.
Points 3–6 and the plan's owner are open.

## 1. The forge is private, with no anonymous access — decided

Every org, repository and package on `forgejo.coulomb.social` is private, and
the final wave sets `REQUIRE_SIGNIN_VIEW=true`. The forge is internal
infrastructure. Public codebases, when there are any, are published to a
separate location with its own publicity, probably not one we build
(GitHub or similar).

## 2. Publication is a per-repo `public/` convention, not a visibility setting — decided

Licensing is experimental and is **not** an input to access decisions.

What to publish, where and for whom is a series of decisions per repository.
They are made through a shared publication-flow mechanism, not reinvented per
repository. The baseline is the Unix home directory's public folder:

- **`public/` holds only symlinks**, never original content. Each link points to
  a file inside the same repository.
- **Everything reachable through `public/` may be made readable from outside**,
  by a publisher that projects it to the public location. Nothing outside
  `public/` is published.
- **Emergency removal:** renaming the folder (for example to `public.withdrawn/`)
  withdraws everything at once.
- **Transparency:** `INTENT.md`, `README.md` and `LICENSE.md` are candidates to
  link from `public/` where showing what a repository is about is wanted.
- **Sanitization:** published content passes a check before it leaves (secrets,
  internal hostnames and addresses, personal data, links into private
  repositories).
- **Hall of Helix** content is published: it is a PR edge. This connects to
  coulomb.social, where a coulomb.social space corresponds to a repository and
  its content is a projection of information in that repository.

### Consequences to carry into the design

- **Withdrawal must propagate.** Renaming `public/` stops new publication. It only
  removes content from the outside if the projection mirrors absence: the
  publisher deletes what is no longer in `public/` on its next run, and a
  withdrawal can trigger that run immediately. What has already been fetched
  outside stays fetched.
- **The publisher is the only reader that crosses the boundary.** It reads
  private repositories with its own read identity, resolves the symlinks,
  sanitizes, and writes to the public target. The forge itself never serves
  `public/` anonymously, which is consistent with point 1.
- **The convention is checkable.** A repository check can enforce that `public/`
  contains only relative symlinks resolving inside the repository, with no
  absolute paths, no `..` escapes and no links to other symlinks.
- **This is ecosystem convention.** The `public/` rule belongs in canon (a
  the-custodian standard, review-gated). The publisher and the coulomb.social
  projection belong to their own owners (coulomb-social, plus a publishing
  component). This plan only needs the forge to be closable without breaking
  the Hall's PR edge.

## 3. Packages follow their repository: private — open

Proposed: one node-level registry login (k3s `registries.yaml`, read-only package
identity) for all 43 workloads; one ArgoCD credential template for the
`coulomb/` repositories; job tokens in CI; package-read tokens for PyPI and npm.

## 4. Telegram post images — open

Proposed: the fluid-telegram adapter fetches the image with a read identity and
uploads it to Telegram, so no image URL needs to be public. Under point 2 the
alternative is the publisher's public target (the Hall's coulomb.social space)
once it exists.

## 5. Interim lockdown — open

Proposed: close now the sensitive repositories with no anonymous reader
(inventory 2026-10-08): `disaster-control`, `railiance-hosts`, `secrets-engine`,
`rapp-secrets-engine`, `rapp-openbao`, `rapp-policy-nexus`, `fin-hub`,
`qonto-assistant`, `rapp-tenant-engine`, `executor-sandbox`, `ops-mason`,
`rein-aharness`, `rein-openweights`.

Under point 2, `hall-of-helix` should stay readable until its publication
path exists, so it is not in the interim set.

## 6. Exposed history — open

Proposed: T03 scans public history and drives rotations in parallel; it does
not block the waves.

## Owner — open

Proposed: the founder holds T01 and T08; an agent drives the rest.